Encrypting network traffic between CS/MA and clients.

Both settings are, as far as I know, only for when agent based communication is performed.

General non agent based activities like push install are not performed via this tunnel as there is no fwconfig file to populate. In addition you use WMI combined with SMB or SSH to perform the push install.

Only when the installer is running and communication with the commserve is started the temporary setup tunnel settings will kick in and after installation the final network topology settings will be adopted to replace the setup tunnel settings.

For agent traffic I tend to use a perimeter construct, isolating the backup environment and use at least 2 dual nic gateway proxies as a bridge between the general infrastructure and the backup environment.
This combined with all clients in a Gateway network topology with encryption enabled and force thru tunnel enabled will ensure all agent data to be transported via an encrypted tunnel.
Commvault's proprietary TLS will prevent impersonation of clients. Ideally you should enforce client certificates, but even without this enabled I have had several hack tests performed and all environments passed the tests.
Command line (qlogin) will be performed over this tunnel as well.

If you have a separate management vlan you can do the same here, deploy gateway proxies and have the Command Center package installed. Then they can connect via 443 to the Command Center and Rest API. If you want to use the Java GUI you can add a TPPM for tcp 8401 so people can connect there, they need to fill in the proxy details within the use firewall section of the GUI login.

@Jos Meijer 

According to their rule, all client agents are installed by push install and it’s also triggered by REST API.

Based on your description seems no way to encrypt the network traffic for push install.

Customer is concerning  the exposure of sensitive information such as user id and password while doing a push install so seeking for the way to encrypt all the communication network traffic/packet except backup data.

Thanks.

That is partially true, however even with a push install, only the base client or minimal communication services are pushed and deployed initially over SMB and remotely started with remote registry / RPC. If you have a network topology / configuration after that, the rest of the install is done over the encrypted tunnel (i.e push of the remaining filesystem or VSA components or whatever you chose to install).

@Damian Andre can you elaborate which part isn't true so I can adjust my view on this matter?

Both settings are managed via the fwconfig method as far as I know. Or are we talking about specific non agent activities which are performed while using encrypted traffic via another method? Or are we talking about ntlm/kerberos/rpc where authentication and remote installation procedures are secured?

Hey Jos,

I was just clarifying that only a minimalist portion of a push install happens over SMB - after the CVD service is installed everything else communicates via the Commvault services which is automatically secured/encrypted if you have the correct network topology settings configured. i.e Any agent options you pick will then be transferred over the built-in file transfer service as part of CVD and not over SMB/SSH - like how updates work.

Ah ok, thanks for your response. 👍

I misinterpreted "however" to indicate that this was a different subject following up on the partially true statement. #languagebarrier

@Jos Meijer , your English is better than most native speakers!!

Thanks @Mike Struening ☺️☺️

Hi, enabling network encryption between CS ↔ MAs following the guides, is there any way to calculate the extra CPU overhead to MAs, after enabling encryption?

Encrypting Network Traffic at CommCell Level (commvault.com)

Enforcing and Encrypting Automatic Tunneling (commvault.com)